REDHAT-BUG-769721: Null Pointer Dereference

Published Dec 21, 2011

Updated

User space may create the PIT and forgets about setting up the irqchips. In that case, firing PIT IRQs will crash the host:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000128 IP: [<ffffffffa10f6280>] kvmsetirq+0x30/0x170 [kvm] ... Call Trace: [<ffffffffa11228c1>] pitdowork+0x51/0xd0 [kvm] [<ffffffff81071431>] processonework+0x111/0x4d0 [<ffffffff81071bb2>] workerthread+0x152/0x340 [<ffffffff81075c8e>] kthread+0x7e/0x90 [<ffffffff815a4474>] kernelthreadhelper+0x4/0x10

Reference: http://permalink.gmane.org/gmane.comp.emulators.kvm.devel/83564

Affected Software

1 affected component

KVM KVM

Event History

Dec 21, 2011

Data Sourced

via Red Hat·09:58 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

KVM hosts are exposed when user space creates a programmable interval timer (PIT) but does not set up the associated irqchips. The issue affects the host kernel rather than only the guest.

What is required to trigger the crash?

An attacker or user needs to be able to create this incomplete KVM device configuration and cause PIT interrupts to fire. Firing those interrupts can lead KVM to dereference a null pointer and crash the host.

How can administrators recognize a possible occurrence?

Affected hosts may crash with a kernel NULL pointer dereference in kvm_set_irq, with pit_do_work appearing in the call trace. The reported fault address is 0000000000000128.

REDHAT-BUG-769721: Null Pointer Dereference

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What is required to trigger the crash?

How can administrators recognize a possible occurrence?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What is required to trigger the crash?

How can administrators recognize a possible occurrence?